yichen-wecom-local-vault

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). Contains deliberate credential-theft behavior: code to read live WeCom process memory or inject a Frida agent to extract raw DB encryption keys, persist those keys to local files, and produce plaintext database snapshots — a high-risk, dual‑use capability that can be abused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). SKILL.md’s required runtime flow decrypts and reads insider-authored local WeCom DB content and WAL (e.g., scripts/vault_cli.py loads and decodes message text from decrypted snapshots), which is outsider-provided free text originating from other users’ messages in the DB.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). Flagged because the skill instructs attaching to processes with Frida, creating/resigning application copies, and explicitly asks the user to run a sudo-enabled Mach VM scan (--confirm-sudo), all of which modify system state or require elevated privileges.